System and method for sharing unstructured data storage function services

Abstract

This disclosure describes systems, methods, and devices related to enhanced unstructured data storage function (UDSF) access. A device may decode a request from a network function (NF) service consumer to access a UDSF data store service, the request including access parameters. The device may decipher whether the NF service consumer is authorized to access based on the access parameter. The device may encode an access token that includes an authorized subset of access parameters if the NF service consumer is authorized. The device may encode a response to the NF service consumer, the response including the encoded access token for subsequent use in a request for the UDSF data store service.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Application No. 63 / 391,526, filed on July 22, 2023, the disclosure of which is incorporated herein by reference as if fully set forth. Technical Field

[0003] The present disclosure relates generally to systems and methods for wireless communications, and more particularly to systems and methods for sharing an unstructured data storage function (UDSF) service. Background Art

[0004] The introduction of Unstructured Data Storage Function (UDSF) provides a solution for standardized storage in cloud-native deployments. However, measures to prevent access based on characteristics and origin need to be specified. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0006] Figure 2 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0007] Figure 3 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0008] Figure 4 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0009] Figure 5 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0010] Figure 6 A flowchart for illustrating a process of an enhanced UDSF access system according to one or more example embodiments of the present disclosure is illustrated.

[0011] Figure 7 An example network architecture is illustrated in accordance with one or more example embodiments of the present disclosure.

[0012] Figure 8 A wireless network according to one or more example embodiments of the present disclosure is schematically illustrated.

[0013] Fig. 9 Components of a computing device according to one or more example embodiments of the present disclosure are illustrated. DETAILED DESCRIPTION

[0014] The following description and the accompanying drawings fully illustrate the specific embodiments to enable those skilled in the art to implement them. Other embodiments may include structural, logical, electrical, process, algorithmic and other changes. Parts and features of some embodiments may be included in other embodiments, or replace parts and features of other embodiments. The embodiments recorded in the claims cover all available equivalents of these claims.

[0015] Unstructured Data Storage Function (UDSF) was introduced in 3GPP Rel-16 as part of the CT4 NUDSF research / work item. UDSF is an important component in cloud-native deployments where NF services may operate in a stateless and dataless manner. Network Functions (NFs) can store state, context, and other data related to their functions in UDSF.

[0016] UDSF-enabled network deployments can benefit from allowing a standardized storage mechanism to hold information for all NFs (regardless of vendor or type), thereby simplifying and optimizing network topologies, as this service allows interoperability and is independent of the underlying database / storage technology.

[0017] There is a requirement that NFs can share UDSF to store their corresponding unstructured data. NFs of the same type and vendor should have one or more different logical storage spaces, and should be able to prevent NFs of another type or vendor from accessing the storage space. NFs of different types or vendors should use different access keys.

[0018] There is a specification on access authorization using OAuth2 protocol, based on local configuration, using "client credentials" authorization grant, where NF repository function (NRF) plays the role of authorization server. However, 3GPP does not specify how to prevent NF access by NF type and NF vendor.

[0019] The present disclosure proposes a method for sharing UDSF using access authorization by NF type and NF vendor. There is no solution to this problem previously.

[0020] Example embodiments of the present disclosure relate to systems, methods, and devices for sharing UDSF services.

[0021] In one embodiment, the enhanced UDSF access system can facilitate a method for UDSF sharing using access authorization per NF type and NF vendor. UDSF-enabled network deployment will simplify the adoption of fully cloud-native solutions (RAN and CN) by supporting the separation of data and compute resources as needed for stateless and dataless NF implementations. Cloud-native solutions will allow telecom networks to deploy standardized compute infrastructure.

[0022] In one or more embodiments, the enhanced UDSF access system can support cellular networks featuring UDSF for any NF to store and retrieve state, context, and other data. The enhanced UDSF access system can use the OAuth2 protocol to authorize access to the UDSF data repository service, with the NRF acting as an authorization server. In addition, the enhanced UDSF access system can enforce logical storage space isolation for NFs of the same type and vendor by assigning dedicated records, storage, or realms.

[0023] In one or more embodiments, the enhanced UDSF access system may also allow the NF service consumer to include its vendor ID, requested domain ID(s), storage ID(s), and record ID(s) in the access token request when requesting access to the UDSF data repository service. In addition, the enhanced UDSF access system may check whether the NF service consumer is authorized to access the requested domain ID(s), storage ID(s), and record ID(s) based on the vendor ID and NF type.

[0024] In one or more embodiments, the enhanced UDSF access system may include the allowed domain ID(s), storage ID(s), and record ID(s) with the access token. Additionally, when requesting a UDSF data repository service, the NF service consumer may include the access token with the allowed domain ID(s), storage ID(s), and record ID(s). Additionally, the enhanced UDSF access system may check whether the requested service operation matches the allowed domain ID, storage ID, and record ID provided with the access token.

[0025] In one or more embodiments, upon successful check, the enhanced UDSF access system may perform the requested service and respond back to the NF service consumer. The enhanced UDSF access system may also ensure protection of data stored in the UDSF and its confidentiality. To ensure data security, the NF service consumer may apply data encryption when writing records to the UDSF and apply data decryption when reading data from the UDSF. Finally, the enhanced UDSF access system may assign security credentials for data confidentiality to the NF service consumer by the NRF upon access authorization.

[0026] The above description is for illustration and is not intended to be limiting. Many other examples, configurations, processes, algorithms, etc. may exist, some of which are described in more detail below. Example embodiments will now be described with reference to the accompanying drawings.

[0027] Figure 1 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0028] refer to Figure 1 , showing a reference model of an Unstructured Data Storage Function (UDSF).

[0029] UDSF was introduced in 3GPP Rel-16 as part of the CT4 NUDSF study / work item. UDSF is an important component in cloud-native deployments where NF services may operate in a stateless and dataless manner. Network functions (NFs) can store states, contexts, and other data related to their functions in UDSF.

[0030] It is to be understood that the above description is intended to be illustrative, and is not intended to be restrictive.

[0031] Figure 2 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0032] refer to Figure 2 , shows an example of UDSF storage.

[0033] The present disclosure proposes a method for sharing UDSF using access authorization by NF type and NF vendor. NFs can share UDSF to store their corresponding unstructured data. NFs of the same type and vendor should have one or more different logical storage spaces, and should be able to prevent NFs of another type or vendor from accessing the storage space. NFs of different types or vendors should use different access keys.

[0034] In one or more embodiments, logical storage space isolation of NFs of the same type and the same vendor is achieved by assigning dedicated records (identified by realm ID, storage ID, and record ID), storage (identified by realm ID and storage ID), or realm (identified by realm ID).

[0035] In one or more embodiments, the enhanced UDSF access system may facilitate the requesting NF service consumer to include its vendor ID and optionally the requested realm ID(s), storage ID(s), and record ID(s) in the OAuth2.0 access token request.

[0036] OAuth2.0 is an open standard for token-based authentication and authorization on the Internet, which allows users to grant third-party applications access to their server resources without sharing their credentials. It provides a secure and flexible method for users to verify application requests for their data, and the authorization server issues a token to the client application after proper authorization.

[0037] The NF Repository Function (NRF) authorizes access by providing an access token that includes the allowed realm ID(s), storage ID(s), and record ID(s). The NF Service Consumer then provides the token to the UDSF along with the requested service operation. The UDSF validates the service request using the allowed realm ID(s), storage ID(s), and record ID(s) from the access token.

[0038] It is to be understood that the above description is intended to be illustrative, and is not intended to be restrictive.

[0039] Figure 3 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0040] refer to Figure 3 , shows the proposed enhanced solution for obtaining an access token before a UDSF data repository service access. The illustrated NF service consumer can obtain an access token before a UDSF data repository service access.

[0041] In one or more embodiments, the NF service consumer requests access to the UDSF data repository service, and in addition, Figure 3 As shown in step 1 of , the NF service consumer may include its vendor ID, requested realm ID(s), storage ID(s), and record ID(s) in the access token request.

[0042] In one or more embodiments, the NRF checks whether the NF Service Consumer is authorized to access the requested domain ID(s), storage ID(s), and record ID(s) based on the vendor ID and NF type. When generating the access token, the NRF may include the allowed domain ID(s), storage ID(s), and record ID(s) provided in step 1 (e.g., a subset of the requested domain ID(s), storage ID(s), and record ID(s)), as Figure 3 as shown in step 2 in .

[0043] In one or more embodiments, the claims in the token may include allowed realm ID(s), storage ID(s), and record ID(s), such as Figure 3 as shown in step 3 in .

[0044] Figure 4 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0045] refer to Figure 4 , shows that the NF service consumer requests UDSF data repository service access with an access token.

[0046] Figure 4 Illustrate enhancements to UDSF data repository service access using access tokens.

[0047] In one or more embodiments, the NF service consumer requests a UDSF data repository service (e.g., a query service operation to retrieve a specific record ID). The NF service consumer includes the allowed domain ID(s), storage ID(s), and record ID(s) with the access token, such as Figure 4 as shown in step 1 of

[0048] In addition, the UDSF checks whether the requested service operation matches the allowed realm ID, storage ID and record ID provided with the access token. If the check is successful, the UDSF shall perform the requested service and respond back to the NF service consumer, such as Figure 4 as shown in step 2 of

[0049] It is to be understood that the above description is intended to be illustrative, and is not intended to be restrictive.

[0050] Figure 5 Depicted is an illustrative diagram of enhanced UDSF access according to one or more example embodiments of the present disclosure.

[0051] refer to Figure 5, showing a UDSF shared across different security domains.

[0052] In one or more embodiments, the enhanced UDSF access system may facilitate privacy protection in a first option.

[0053] This option provides confidentiality protection for data stored in the UDSF. This may be required if the UDSF is shared across different security domains. For example, the RAN and CN may have their own security domains.

[0054] like Figure 5 As shown in , NF shall apply data encryption when writing records to UDSF and apply data decryption when reading data from UDSF. Security credentials are provided by NRF during access authorization ( Figure 3 A specific set of security credentials may be shared between all NFs within a security domain, or only between specific NFs (e.g., NFs of the same type and vendor) that share a common data space within a UDSF.

[0055] In some embodiments, Figure 7-Figure 9 Or (one or more) electronic devices, (one or more) networks, (one or more) systems, (one or more) chips or (one or more) components of some other figures of this document, or some parts or implementations thereof, can be configured to perform one or more processes, techniques or methods as described herein, or some parts thereof. One such process is in Figure 6 Depicted in.

[0056] For example, the process may include, at 602, decoding a request from a network function (NF) service consumer to access an unstructured data storage function (UDSF) data repository service, the request including access parameters.

[0057] The process also includes, at 604, deciphering whether the NF service consumer is authorized to access based on the access parameter.

[0058] The process also includes, at 606, encoding an access token including an authorized subset of access parameters if the NF service consumer is authorized.

[0059] The process also includes, at 608, encoding a response to the NF service consumer, the response including the encoded access token for subsequent use in a request to the UDSF data repository service.

[0060] For one or more embodiments, at least one of the components described in one or more of the foregoing figures may be configured to perform one or more operations, techniques, processes and / or methods described in the example section below. For example, the baseband circuit described above in connection with one or more of the foregoing figures may be configured to operate according to one or more examples described below. For another example, the circuits associated with UE, base station, network element, etc. described above in connection with one or more of the foregoing figures may be configured to operate according to one or more examples described below in the example section.

[0061] It is to be understood that the above description is intended to be illustrative, and is not intended to be restrictive.

[0062] Figure 7-Figure 9 Various systems, devices, and components are illustrated in which aspects of the disclosed embodiments may be implemented.

[0063] Figure 7 An example network architecture 700 is illustrated according to various embodiments. The network 700 may operate in a manner consistent with the 3GPP technical specifications for LTE or 5G / NR systems. However, the example embodiments are not limited thereto, and the described embodiments may be applied to other networks that benefit from the principles described herein, such as future 3GPP systems, etc.

[0064] The network 700 includes a UE 702, which is any mobile or non-mobile computing device designed to communicate with a RAN 704 via an air connection. The UE 702 is communicatively coupled to the RAN 704 via a Uu interface, which can be applicable to both LTE and NR systems. Examples of UE 702 include, but are not limited to, smartphones, tablet computers, wearable computers, desktop computers, laptop computers, in-vehicle infotainment systems, in-vehicle entertainment systems, dashboards, head-up display (HUD) devices, onboard diagnostic devices, dashboard mobile devices, mobile data terminals, electronic engine management systems, electronic / engine control units, electronic / engine control modules, embedded systems, sensors, microcontrollers, control modules, engine management systems, networked appliances, machine-type communication devices, machine-to-machine (M2M), device-to-device (D2D), machine-type communication (MTC) devices, Internet of Things (IoT) devices, and the like. The network 700 may include multiple UEs 702 directly coupled to each other via D2D, ProSe, PC5 and / or sidelink (SL) interfaces. These UEs 702 may be M2M / D2D / MTC / IoT devices and / or vehicle-mounted systems that communicate using physical sidelink channels, such as but not limited to PSBCH, PSDCH, PSSCH, PSCCH, PSFCH, etc. The UE 702 may perform blind decoding attempts on the SL channel / link according to various embodiments herein.

[0065] In some embodiments, UE 702 may also communicate with AP 706 via an over-the-air (OTA) connection. AP 706 manages a WLAN connection, which may be used to offload some / all network traffic from RAN 704. The connection between UE 702 and AP 706 may conform to any IEEE 802.11 protocol. In addition, UE 702, RAN 704, and AP 706 may utilize cellular-WLAN aggregation / integration (e.g., LWA / LWIP). Cellular-WLAN aggregation may involve UE 702 being configured by RAN 704 to utilize both cellular radio resources and WLAN resources.

[0066] The RAN 704 includes one or more access network nodes (AN) 708. The AN 708 terminates (one or more) air interfaces for the UE 702 by providing access layer protocols including RRC, PDCP, RLC, MAC, and PHY / L1 protocols. In this way, the AN 708 enables data / voice connectivity between the CN 720 and the UE 702. The AN 708 can be a macrocell base station, or a low-power base station for providing a femtocell, picocell, or other similar cell with a smaller coverage area, smaller user capacity, or higher bandwidth than a macrocell; or some combination of these. In these implementations, the AN 708 is referred to as a BS, gNB, RAN node, eNB, ng-eNB, NodeB, RSU, TRxP, etc.

[0067] One example implementation is a "CU / DU split" architecture, in which the AN 708 is embodied as a gNB-Central Unit (CU) communicatively coupled to one or more gNB-Distributed Units (DUs), wherein each DU may be communicatively coupled to one or more Radio Units (RUs) (also referred to as RRHs, RRUs, etc.) (e.g., see 3GPP TS 38.401 v16.1.0 (2020-03)). In some implementations, one or more RUs may be individual RSUs. In some implementations, the CU / DU split may include one ng-eNB-CU and one or more ng-eNB-DUs, respectively, instead of, or in addition to, the gNB-CU and gNB-DU. The AN 708 employed as a CU may be implemented in a discrete device or as one or more software entities running on a server computer, for example, as part of a virtual network including a virtual baseband unit (BBU) or a BBU pool, a cloud RAN (CRAN), a radio equipment controller (REC), a radio cloud center (RCC), a centralized RAN (C-RAN), a virtualized RAN (vRAN), etc. (although these terms may refer to different implementation concepts). Any other type of architecture, arrangement and / or configuration may also be used.

[0068] Multiple ANs may be coupled to each other via an X2 interface (if RAN 704 is an LTE RAN or Evolved Universal Terrestrial Radio Access Network (E-UTRAN) 710) or an Xn interface (if RAN 704 is an NG-RAN 714). The X2 / Xn interface (which may be separated into control / user plane interfaces in some embodiments) may allow ANs to communicate information related to handover, data / context transfer, mobility, load management, interference coordination, and the like.

[0069] The ANs of the RAN 704 may each manage one or more cells, cell groups, component carriers, etc. to provide an air interface for network access to the UE 702. The UE 702 may be simultaneously connected to multiple cells provided by the same or different ANs 708 of the RAN 704. For example, the UE 702 and the RAN 704 may use carrier aggregation to allow the UE 702 to connect to multiple component carriers, each corresponding to a Pcell or Scell. In a dual connectivity scenario, the first AN 708 may be a primary node providing an MCG, and the second AN 708 may be a secondary node providing an SCG. The first / second AN 708 may be any combination of eNBs, gNBs, ng-eNBs, etc.

[0070] RAN 704 may provide an air interface via a licensed spectrum or an unlicensed spectrum. In order to operate in an unlicensed spectrum, a node may use LAA, eLAA, and / or feLAA mechanisms based on CA technology and PCell / Scell. Before accessing an unlicensed spectrum, a node may perform a medium / carrier sensing operation based on, for example, a listen-before-talk (LBT) protocol.

[0071] In the V2X scenario, the UE 702 or AN 708 may be or act as a roadside unit (RSU), which may refer to any traffic infrastructure entity used for V2X communication. The RSU may be implemented in or by an appropriate AN or a fixed (or relatively fixed) UE. An RSU implemented in or by a UE may be referred to as a "UE-type RSU"; an RSU implemented in or by an eNB may be referred to as an "eNB-type RSU"; an RSU implemented in or by a gNB may be referred to as a "gNB-type RSU"; and so on. In one example, an RSU is a computing device coupled to a roadside RF circuit that provides connectivity support to passing vehicle UEs. The RSU may also include internal data storage circuits to store intersection map geometry, traffic flow statistics, media, and applications / software to sense and control ongoing vehicle and pedestrian traffic flow. The RSU may provide extremely low latency communications required for high-speed events such as collision avoidance, traffic warnings, and the like. Additionally or alternatively, the RSU may provide other cellular / WLAN communication services. The components of the RSU may be housed in a weatherproof enclosure suitable for outdoor installation and may include a network interface controller to provide a wired connection (eg, Ethernet) to a traffic signal controller or backhaul network.

[0072] In some embodiments, the RAN 704 may be an E-UTRAN 710 with one or more eNBs 712. The E-UTRAN 710 may provide an LTE air interface (Uu) with the following characteristics: SCS of 15 kHz; CP-OFDM waveform for DL ​​and SC-FDMA waveform for UL; turbo coding for data and TBCC for control; etc. The LTE air interface may rely on CSI-RS for CSI acquisition and beam management; rely on PDSCH / PDCCH DMRS for PDSCH / PDCCH demodulation; and rely on CRS for cell search and initial acquisition, channel quality measurement, and channel estimation for coherent demodulation / detection at the UE. The LTE air interface may operate on frequency bands below 6 GHz.

[0073] In some embodiments, the RAN 704 may be a next generation (NG)-RAN 714 having one or more gNBs 716 and / or one or more ng-eNBs 718. The gNB 716 is connected to the 5G-enabled UE 702 using a 5G NR interface. The gNB 716 is connected to the 5GC 740 via an NG interface, which may include an N2 interface or an N3 interface. The ng-eNB 718 is also connected to the 5GC 740 via an NG interface, but may be connected to the UE 702 via a Uu interface. The gNB 716 and the ng-eNB 718 may be connected to each other via an Xn interface.

[0074] In some embodiments, the NG interface can be divided into two parts, one is the NG user plane (NG-U) interface, which carries traffic data between the nodes of the NG-RAN 714 and the UPF 748 (e.g., the N3 interface), and the other is the NG control plane (NG-C) interface, which is the signaling interface between the nodes of the NG-RAN 714 and the AMF 744 (e.g., the N2 interface).

[0075] NG-RAN 714 may provide a 5G-NR air interface (also referred to as Uu interface) with the following features: variable SCS; CP-OFDM for DL, CP-OFDM and DFT-s-OFDM for UL; polar, repetition, simplex, and Reed-Muller codes for control, and LDPC for data. The 5G-NR air interface may rely on CSI-RS, PDSCH / PDCCH DMRS, similar to the LTE air interface. The 5G-NR air interface may not use CRS, but may use PBCH DMRS for PBCH demodulation; use PTRS for phase tracking of PDSCH; and use tracking reference signals for time tracking. The 5G-NR air interface may operate on FR1 bands including bands below 6 GHz or FR2 bands including bands from 24.25 GHz to 52.6 GHz. The 5G-NR air interface may include an SSB, which is an area of ​​a downlink resource grid including PSS / SSS / PBCH.

[0076] The 5G-NR air interface can utilize BWP for various purposes. For example, BWP can be used for dynamic adaptation of SCS. For example, UE 702 can be configured with multiple BWPs, each of which is configured with a different SCS. When a BWP change is indicated to UE 702, the SCS of the transmission will also be changed. Another use case example of BWP is related to power saving. Specifically, UE 702 can be configured with multiple BWPs with different amounts of frequency resources (e.g., PRBs) to support data transmission in different traffic load scenarios. A BWP containing a smaller number of PRBs can be used for data transmission with a small traffic load, while allowing power savings at UE 702 and in some cases at gNB 716. A BWP containing a larger number of PRBs can be used for scenarios with higher traffic loads.

[0077] The RAN 704 is communicatively coupled to the CN 720, which includes network elements and / or network functions (NFs) to provide various functions to support data and telecommunication services to customers / subscribers (e.g., UE 702). The components of the CN 720 may be implemented in one physical node or in separate physical nodes. In some embodiments, any or all functions provided by the network elements of the CN 720 may be virtualized onto physical computing / storage resources in servers, switches, etc. using NFV. A logical instantiation of the CN 720 may be referred to as a network slice, and a logical instantiation of a portion of the CN 720 may be referred to as a network sub-slice.

[0078] CN 720 may be LTE CN 722 (also referred to as Evolved Packet Core (EPC) 722). EPC 722 may include MME 724, SGW 726, SGSN 728, HSS 730, PGW 732, and PCRF 734, which are coupled to each other via interfaces (or "reference points"), as shown. The NFs in EPC 722 are briefly described as follows.

[0079] The MME 724 implements mobility management functions to track the current location of the UE 702, to facilitate paging, bearer activation / deactivation, handover, gateway selection, authentication, and the like.

[0080] The SGW 726 terminates the S1 interface towards the RAN 710 and routes data packets between the RAN 710 and the EPC 722. The SGW 726 can be the local mobility anchor point for handovers between RAN nodes and can also provide an anchor for inter-3GPP mobility. Other responsibilities may include lawful interception, charging, and some policy enforcement.

[0081] SGSN 728 tracks the location of UE 702 and performs security functions and access control. SGSN 728 also performs EPC inter-node signaling for mobility between different RAT networks; selects PDN and S-GW as specified by MME 724; selects MME 724 for handover; etc. The S3 reference point between MME 724 and SGSN 728 enables user and bearer information exchange for inter-3GPP access network mobility in idle / active states.

[0082] HSS 730 includes a database for network users, including subscription-related information, to support network entities in handling communication sessions. HSS 730 may provide support for routing / roaming, authentication, authorization, naming / addressing resolution, location dependency, etc. The S6a reference point between HSS 730 and MME 724 may enable the transfer of subscription and authentication data to authenticate / authorize user access to EPC 720.

[0083] The PGW 732 may terminate the SGi interface towards a data network (DN) 736, which may include an application (app) / content server 738. The PGW 732 routes data packets between the EPC 722 and the data network 736. The PGW 732 is communicatively coupled to the SGW 726 via an S5 reference point to facilitate user plane tunneling and tunnel management. The PGW 732 may also include a node (e.g., PCEF) for policy enforcement and charging data collection. In addition, the SGi reference point may communicatively couple the PGW 732 to the same or different data network 736. The PGW 732 may be communicatively coupled to the PCRF 734 via a Gx reference point.

[0084] PCRF 734 is the policy and charging control element of EPC 722. PCRF 734 is communicatively coupled with application / content server 738 to determine the appropriate QoS and charging parameters for the service flow. PCRF 732 also configures the associated rules into PCEF with the appropriate TFT and QCI (via the Gx reference point).

[0085] CN 720 may be 5GC 740, which includes AUSF 742, AMF 744, SMF 746, UPF 748, NSSF 750, NEF 752, NRF 754, PCF 756, UDM 758, and AF 760, which are coupled to each other through various interfaces as shown. NFs in 5GC 740 are briefly introduced as follows.

[0086] The AUSF 742 stores data used for authentication of the UE 702 and handles authentication related functions. The AUSF 742 may facilitate a common authentication framework for various access types.

[0087] AMF 744 allows other functions of 5GC 740 to communicate with UE 702 and RAN 704, and subscribes to notifications about mobility events for UE 702. AMF 744 is also responsible for registration management (e.g., for registering UE 702), connection management, reachability management, mobility management, legal interception of AMF-related events, and access authentication and authorization. AMF 744 provides transmission for SM messages between UE 702 and SMF 746, and acts as a transparent agent for routing SM messages. AMF 744 also provides transmission for SMS messages between UE 702 and SMSF. AMF 744 interacts with AUSF 742 and UE 702 to perform various security anchoring and context management functions. In addition, AMF 744 is the termination point of the RAN-CP interface, which includes the N2 reference point between RAN 704 and AMF 744. AMF 744 is also the termination point for NAS (N1) signaling, and performs NAS encryption and integrity protection.

[0088] The AMF 744 also supports NAS signaling with the UE 702 through the N3IWF interface. The N3IWF provides access to untrusted entities. The N3IWF can be the termination point of the N2 interface between the (R)AN 704 and the AMF 744 for the control plane, and the termination point of the N3 reference point between the (R)AN 714 and the UPF 748 for the user plane. In this way, the AMF 744 handles N2 signaling from the SMF 746 and the AMF 744 for PDU sessions and QoS, encapsulates / decapsulates packets for IPSec and N3 tunneling, marks N3 user plane packets in the uplink, and enforces QoS corresponding to the N3 packet marking, taking into account the QoS requirements associated with such marking received over N2. The N3IWF may also relay UL and DL control plane NAS signaling between the UE 702 and the AMF 744 via the N1 reference point between the UE 702 and the AMF 744, and relay uplink and downlink user plane packets between the UE 702 and the UPF 748. The N3IWF also provides a mechanism for IPsec tunnel establishment with the UE 702. The AMF 744 may present a Namf service-based interface and may be the termination point for the N14 reference point between two AMFs 744 and the interface between the AMF 744 and the 5G-EIR ( Figure 7 N17 reference point between the two (not shown).

[0089] SMF 746 is responsible for SM (e.g., session establishment, tunnel management between UPF 748 and AN 708); UE IP address allocation and management (including optional authorization); selection and control of UP functions; configuration of traffic steering at UPF 748 to route traffic to the appropriate destination; termination of interfaces towards policy control functions; control portion of policy enforcement, charging and QoS; lawful interception (for SM events and interface to LI system); termination of SM portion of NAS messages; downlink data notification; initiation of AN-specific SM information sent to AN 708 via AMF 744 over N2; and determination of SSC mode for sessions. SM refers to the management of PDU sessions, and PDU sessions or "sessions" refer to PDU connectivity services that provide or enable the exchange of PDUs between UE 702 and DN 736.

[0090] The UPF 748 acts as an anchor point for intra-RAT and inter-RAT mobility, an external PDU session point for interconnection to the data network 736, and a branch point to support multi-homed PDU sessions. The UPF 748 also performs packet routing and forwarding, packet inspection, enforces the user plane portion of policy rules, lawful interception of packets (UP collection), performs traffic usage reporting, performs QoS handling for the user plane (e.g., packet filtering, gating, UL / DL rate enforcement), performs uplink traffic validation (e.g., SDF to QoS flow mapping), transport level packet marking in uplink and downlink, and performs downlink packet buffering and downlink data notification triggering. The UPF 748 may include an uplink classifier to support routing of traffic flows to the data network.

[0091] The NSSF 750 selects a set of network slice instances to serve the UE 702. If necessary, the NSSF 750 also determines the allowed NSSAIs and the mapping to the subscribed S-NSSAIs. The NSSF 750 also determines the set of AMFs to be used to serve the UE 702, or a list of candidate AMFs 744, based on appropriate configuration and possibly by querying the NRF 754. The selection of a set of network slice instances for the UE 702 may be triggered by the AMF 744 with which the UE 702 is registered, by interacting with the NSSF 750; this may result in a change of the AMF 744. The NSSF 750 interacts with the AMF 744 via the N22 reference point; and may communicate with another NSSF in the visited network via the N31 reference point (not shown).

[0092] NEF 752 securely exposes the services and capabilities provided by 3GPP NF to third parties, internal exposure / re-exposure, AF760, edge computing or fog computing systems (e.g., edge computing nodes, etc.). In this embodiment, NEF 752 can authenticate, authorize or throttle AF. NEF 752 can also translate information exchanged with AF 760 and information exchanged with internal network functions. For example, NEF 752 can translate between AF service identifiers and internal 5GC information. NEF 752 can also receive information from other NFs based on the exposed capabilities of other NFs. This information can be stored at NEF 752 as structured data, or stored at a data storage NF using a standardized interface. The stored information can then be exposed to other NFs and AFs by NEF 752, or used for other purposes, such as parsing.

[0093] NRF 754 supports service discovery function, receives NF discovery request from NF instance, and provides information of discovered NF instance to the requesting NF instance. NRF 754 also maintains information of available NF instances and their supported services. NRF 754 also supports service discovery function, where NRF 754 receives NF discovery request from NF instance or SCP (not shown), and provides information of discovered NF instance to NF instance or SCP.

[0094] PCF 756 provides policy rules to the control plane functions to enforce them, and may also support a unified policy framework to constrain network behavior. PCF 756 may also implement a front end to access subscription information related to policy decisions in the UDR of UDM 758. In addition to communicating with functions through reference points as shown, PCF 756 may also expose Npcf service-based interfaces.

[0095] UDM 758 handles subscription related information to support the handling of communication sessions by network entities, and stores subscription data for UE 702. For example, subscription data can be communicated via the N8 reference point between UDM 758 and AMF 744. UDM 758 may include two parts, an application front end and a UDR. UDR may store subscription data and policy data for UDM 758 and PCF 756, and / or store structured data and application data for exposure for NEF 752 (including PFD for application detection, application request information for multiple UE 702). Nudr service-based interfaces may be presented by UDR 221 to allow UDM 758, PCF756, and NEF 752 to access a specific set of stored data, as well as read, update (e.g., add, modify), delete, and subscribe to notifications of changes in related data in the UDR. UDM may include UDM-FE, which is responsible for handling credentials, location management, subscription management, and the like. Several different front ends may serve the same user in different transactions. UDM-FE accesses subscription information stored in UDR and performs authentication credential processing, user identity handling, access authorization, registration / mobility management, and subscription management. In addition to communicating with other NFs through reference points as shown, UDM 758 can also expose Nudm service-based interfaces.

[0096] AF 760 provides application influence on traffic routing, provides access to NEF 752, and interacts with the policy framework for policy control. AF 760 can influence UPF 748 (re)selection and traffic routing. Based on operator deployment, when AF 760 is considered a trusted entity, the network operator may allow AF 760 to interact directly with the relevant NF. In addition, AF 760 can be used for edge computing implementations.

[0097] 5GC 740 can implement edge computing by selecting an operator / third party service to be geographically close to the point where UE 702 attaches to the network. This can reduce latency and load on the network. In an edge computing implementation, 5GC 740 can select a UPF 748 close to UE 702 and perform traffic manipulation from UPF 748 to DN 736 via the N6 interface. This can be based on UE subscription data, UE location and information provided by AF 760, which allows AF 760 to influence UPF (re)selection and traffic routing.

[0098] Data network (DN) 736 can represent various network operator services, Internet access or third-party services, which can be provided by one or more servers, including, for example, application (app) / content server 738. DN 736 can be an operator's external public network, a dedicated PDN, or an operator's internal packet data network, for example, for the configuration of IMS services. In this embodiment, application server 738 can be coupled to IMS via S-CSCF or I-CSCF. In some implementations, DN 736 can represent one or more local area DNs (LADN), that is, DN 736 (or DN name (DN name, DNN)) that UE 702 can access in one or more specific areas. Outside these specific areas, UE 702 cannot access LADN / DN 736.

[0099] Additionally or alternatively, DN 736 may be an edge DN 736, i.e., a (local) data network that supports an architecture for implementing edge applications. In these embodiments, application server 738 may represent a physical hardware system / device that provides application server functionality and / or application software that resides in the cloud or at an edge computing node that performs (one or more) server functions. In some embodiments, application / content server 738 provides an edge hosting environment that provides the support required for the execution of edge application servers.

[0100] In some embodiments, 5GS may use one or more edge computing nodes to provide interfaces and load transfer the processing of wireless communication traffic. In these embodiments, the edge computing node may be included in one or more RAN710, 714, or co-located with one or more RAN710, 714. For example, the edge computing node may provide a connection between the RAN 714 and the UPF 748 in the 5GC740. The edge computing node may use one or more NFV instances instantiated on the virtualized infrastructure within the edge computing node to handle the wireless connection between the RAN 714 and the UPF 748.

[0101] The interfaces of 5GC 740 include reference points and service-based interfaces. Reference points include: N1 (between UE 702 and AMF 744), N2 (between RAN 714 and AMF 744), N3 (between RAN 714 and UPF 748), N4 (between SMF 746 and UPF 748), N5 (between PCF 756 and AF 760), N6 (between UPF 748 and DN 736), N7 (between SMF 746 and PCF 756), N8 (between UDM 758 and AMF 744), N9 (between two UPFs 748), N10 (between UDM 758 and SMF 746), N11 (between AMF 744 and SMF 746), N12 (between AUSF 742 and AMF 744), N13 (between AUSF 742 and UDM 758), N14 (between two AMFs 744; not shown), N15 (between PCF 756 and AMF 744 in the case of a non-roaming scenario, or between PCF 756 and AMF 744 in a visited network in the case of a roaming scenario), N16 (between two SMFs 746; not shown), and N22 (between AMF 744 and NSSF 750). Figure 7 Other reference points not shown are indicated. Figure 7 The service-based representation represents NFs within the control plane that enable other authorized NFs to access their services. The service-based interfaces (SBIs) include: Namf (SBI presented by AMF 744), Nsmf (SBI presented by SMF 746), Nnef (SBI presented by NEF 752), Npcf (SBI presented by PCF 756), Nudm (SBI presented by UDM 758), Naf (SBI presented by AF 760), Nnrf (SBI presented by NRF 754), Nnssf (SBI presented by NSSF 750), Nausf (SBI presented by AUSF 742). You can also use Figure 7 Other service-based interfaces (e.g., Nudr, N5g-eir, and Nudsf) not shown in the figure. In some embodiments, NEF 752 may provide an interface to edge computing nodes 736x, which may be used to handle wireless connections with RAN 714.

[0102] In some implementations, the system 700 may include an SMSF that is responsible for SMS subscription checking and verification, and relaying SM messages to / from the UE 702 to / from other entities such as SMS-GMSC / IWMSC / SMS routers. The SMS may also interact with the AMF 744 and the UDM 758 to perform notification procedures regarding the availability of the UE 702 for SMS delivery (e.g., setting a UE unreachable flag and notifying the UDM 758 when the UE 702 is available for SMS).

[0103] 5GS may also include SCP (or individual instances of SCP), which supports indirect communication (e.g., see 3GPP TS23.501 Section 7.1.1); delegated discovery (e.g., see 3GPP TS23.501 Section 7.1.1); message forwarding and routing to destination NF / (one or more) NF services, communication security (e.g., authorizing NF service consumers to access NF service producer APIs) (e.g., see 3GPP TS 33.501), load balancing, monitoring, overload control, etc.; and discovery and selection functions for (one or more) UDMs, (one or more) AUSFs, (one or more) UDRs, (one or more) PCFs, which may access subscription data stored in the UDR based on the UE's SUPI, SUCI or GPSI (e.g., see 3GPP TS23.501 Section 6.3). The load balancing, monitoring and overload control functions provided by the SCP may be implementation-dependent. The SCP may be deployed in a distributed manner. There may be more than one SCP in the communication path between various NF services. Although SCP is not an NF instance, it can also be deployed in a distributed, redundant, and scalable manner.

[0104] Figure 8 A wireless network 800 according to various embodiments is schematically illustrated. The wireless network 800 may include a UE 802 in wireless communication with an AN 804. The UE 802 and the AN 804 may be similar to those described in reference to FIG. Figure 7 Components with similar names are described and are substantially interchangeable with such components.

[0105] UE 802 may be communicatively coupled with AN 804 via connection 806. Connection 806 is illustrated as an air interface to enable the communicative coupling and may conform to a cellular communication protocol, such as an LTE protocol or a 5G NR protocol operating at mmWave or sub-6 GHz frequencies.

[0106] UE 802 may include a host platform 808 coupled to a modem platform 810. Host platform 808 may include application processing circuitry 812, which may be coupled to protocol processing circuitry 814 of modem platform 810. Application processing circuitry 812 may run various applications that source / sink application data for UE 802. Application processing circuitry 812 may further implement one or more layer operations to send / receive application data to / from a data network. These layer operations may include transport (e.g., UDP) and Internet (e.g., IP) operations.

[0107] The protocol processing circuitry 814 may implement one or more layer operations to facilitate sending or receiving data over the connection 806. The layer operations implemented by the protocol processing circuitry 814 may include, for example, MAC, RLC, PDCP, RRC, and NAS operations.

[0108] The modem platform 810 may also include digital baseband circuitry 816, which may implement one or more layer operations in the network protocol stack "below" the layer operations performed by the protocol processing circuitry 814. These operations may include, for example, PHY operations, including one or more of the following: HARQ acknowledgement (ACK) functions, scrambling / descrambling, encoding / decoding, layer mapping / demapping, modulation symbol mapping, received symbol / bit metric determination, multiple antenna port precoding / decoding (which may include one or more of space-time, space-frequency, or space coding), reference signal generation / detection, preamble sequence generation and / or decoding, synchronization sequence generation / detection, control channel signal blind decoding, and other related functions.

[0109] The modem platform 810 may also include a transmit circuit 818, a receive circuit 820, an RF circuit 822, and an RF front end (RFFE) 824, which may include or be connected to one or more antenna panels 826. In brief, the transmit circuit 818 may include a digital-to-analog converter, a mixer, an intermediate frequency (IF) component, etc.; the receive circuit 820 may include an analog-to-digital converter, a mixer, an IF component, etc.; the RF circuit 822 may include a low noise amplifier, a power amplifier, a power tracking component, etc.; the RFFE 824 may include a filter (e.g., a surface / bulk acoustic wave filter), a switch, an antenna tuner, a beamforming component (e.g., a phased array antenna component), etc. The selection and arrangement of the components of the transmit circuit 818, the receive circuit 820, the RF circuit 822, the RFFE 824, and the antenna panel 826 (generally referred to as the "transmit / receive components") may depend on the details of the specific implementation, such as whether the communication is TDM or FDM, at mmWave or sub-6gHz frequencies, etc. In some embodiments, the transmit / receive components may be arranged in multiple parallel transmit / receive chains, may be disposed in the same or different chips / modules, and so on.

[0110] In some embodiments, the protocol processing circuit 814 may include one or more instances of control circuitry (not shown) to provide control functionality for the transmit / receive components.

[0111] UE 802 reception may be established by and via antenna panel 826, RFFE 824, RF circuitry 822, receive circuitry 820, digital baseband circuitry 816, and protocol processing circuitry 814. In some embodiments, antenna panel 826 may receive transmissions from AN 804 via receive beamforming signals received by multiple antennas / antenna elements of one or more antenna panels 826.

[0112] UE 802 transmission can be established by and via protocol processing circuitry 814, digital baseband circuitry 816, transmit circuitry 818, RF circuitry 822, RFFE 824, and antenna panel 826. In some embodiments, the transmit component of UE 804 can apply a spatial filter to the data to be transmitted to form a transmit beam emitted by the antenna elements of antenna panel 826.

[0113] Similar to UE 802, AN 804 may include a host platform 828 coupled to a modem platform 830. The host platform 828 may include application processing circuitry 832 coupled to protocol processing circuitry 834 of the modem platform 830. The modem platform may also include digital baseband circuitry 836, transmit circuitry 838, receive circuitry 840, RF circuitry 842, RFFE circuitry 844, and antenna panel 846. The components of AN 804 may be similar to the like-named components of UE 802 and are substantially interchangeable. In addition to performing data transmission / reception as described above, the components of AN 808 may also perform various logical functions including, for example, RNC functions such as radio bearer management, uplink and downlink dynamic radio resource management, and data packet scheduling.

[0114] Fig. 9 Components of a computing device 900 are illustrated that can read instructions from a machine-readable or computer-readable medium (e.g., a non-transitory machine-readable storage medium) and execute any one or more of the methods discussed herein according to some example embodiments. Specifically, Fig. 9 A diagrammatic representation of hardware resources 901 is shown, including one or more processors (or processor cores) 910, one or more memory / storage devices 920, and one or more communication resources 930, each of which may be communicatively coupled via a bus 940 or other interface circuitry. For embodiments utilizing node virtualization (e.g., NFV), a hypervisor 902 may be executed to provide an execution environment for one or more network slices / subslices utilizing hardware resources 901.

[0115] The processor 910 includes, for example, a processor 912 and a processor 914. The processor 910 includes circuits such as (but not limited to): one or more processor cores and one or more of the following: cache memory, a low drop-out (LDO) voltage regulator, an interrupt controller, a serial interface such as SPI, I2C or a general programmable serial interface circuit, a real time clock (RTC), a timer-counter including an interval and a watchdog timer, a general I / O, a memory card controller such as a secure digital / multi-media card (SD / MMC), an interface, a mobile industry processor interface (MIPI) interface, and a Joint Test Access Group (JTAG) test access port. The processor 910 may be, for example, a central processing unit (CPU), a reduced instruction set computing (RISC) processor, an Acorn RISC Machine (ARM) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), one or more digital signal processors (DSP) (e.g., a baseband processor), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a radio-frequency integrated circuit (RFIC), one or more microprocessors or controllers, another processor (including those discussed herein), or any suitable combination of these. In some implementations, the processor circuit 910 may include one or more hardware accelerators, which may be microprocessors, programmable processing devices (e.g., FPGA, complex programmable logic device (CPLD), etc.), etc.

[0116] The memory / storage device 920 may include main memory, disk storage, or any suitable combination of these. The memory / storage device 920 may include, but is not limited to, any type of volatile, non-volatile, or semi-volatile memory, such as random access memory (RAM), dynamic RAM (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, solid-state storage, phase change RAM (PRAM), resistive memory (e.g., magnetoresistive random access memory (MRAM)), etc., and may include memory from and The memory / storage device 920 may also include a persistent storage device, which may be any type of temporary and / or persistent storage device, including but not limited to non-volatile memory, optical, magnetic and / or solid-state mass storage devices, etc.

[0117] The communication resources 930 may include interconnect or network interface controllers, components or other appropriate devices to communicate with one or more peripheral devices 904 or one or more databases 906 or other network elements via the network 908. For example, the communication resources 930 may include wired communication components (e.g., for coupling via USB, Ethernet, Ethernet, Ethernet through a GRE tunnel, Ethernet through Multiprotocol Label Switching (MPLS), Ethernet through USB, Controller Area Network (CAN), Local Interconnect Network (LIN), DeviceNet, ControlNet, DataHighway+, PROFIBUS or PROFINET, etc.), cellular communication components, NFC components, (or low energy ) components, Components, and other communication components. Network connectivity to / from computing device 900 may be provided via communication resources 930 using physical connections, which may be electrical connections (e.g., "copper interconnects") or fiber optic connections. The physical connections also include appropriate input connectors (e.g., ports, sockets, receptacles, etc.) and output connectors (e.g., plugs, pins, etc.). Communication resources 930 may include one or more dedicated processors and / or FPGAs to communicate using one or more of the above-mentioned network interface protocols.

[0118] The instructions 950 may include software, programs, applications, applet programs, apps, or other executable code for causing at least any one of the processors 910 to perform any one or more of the methods discussed herein. The instructions 950 may reside in whole or in part within at least one of the processors 910 (e.g., within a cache memory of the processor), within the memory / storage device 920, or any suitable combination of these. In addition, any portion of the instructions 950 may be transferred to the hardware resources 901 from any combination of the peripheral device 904 or the database 906. Therefore, the memory of the processor 910, the memory / storage device 920, the peripheral device 904, and the database 906 are examples of computer-readable and machine-readable media.

[0119] For one or more embodiments, at least one of the components described in one or more of the foregoing figures may be configured to perform one or more operations, techniques, processes and / or methods described in the example section below. For example, the baseband circuit described above in connection with one or more of the foregoing figures may be configured to operate according to one or more examples described below. For another example, the circuits associated with UE, base station, network element, etc. described above in connection with one or more of the foregoing figures may be configured to operate according to one or more examples described below in the example section.

[0120] Other examples of the presently described embodiments include the following non-limiting implementations. Each of the following non-limiting examples may stand alone or may be combined with any one or more of the other examples provided below or throughout the present disclosure in any permutation or combination.

[0121] For one or more embodiments, at least one of the components described in one or more of the foregoing figures may be configured to perform one or more operations, techniques, processes and / or methods described in the example section below. For example, the baseband circuit described above in connection with one or more of the foregoing figures may be configured to operate according to one or more examples described below. For another example, the circuits associated with UE, base station, network element, etc. described above in connection with one or more of the foregoing figures may be configured to operate according to one or more examples described below.

[0122] The following examples relate to further embodiments.

[0123] Example 1 may include a device that includes decoding a request from a network function (NF) service consumer for access to an unstructured data storage function (UDSF) data repository service, the request including access parameters; deciphering whether the NF service consumer is authorized to access based on the access parameters; if the NF service consumer is authorized, encoding an access token, the access token including an authorized subset of the access parameters; encoding a response to the NF service consumer, the response including the encoded access token for subsequent use in a request for the UDSF data repository service.

[0124] Example 2 may include an apparatus as described in Example 1 and / or some other example herein, wherein the processing circuit may be further configured to encode the access token using an OAuth2 protocol.

[0125] Example 3 may include an apparatus as described in Example 1 and / or some other example herein, wherein the processing circuit may be further configured to perform logical storage space isolation of NFs of the same type and the same vendor by assigning dedicated records, storage, or domains identified by the access parameters.

[0126] Example 4 may include an apparatus as described in Example 1 and / or some other example herein, wherein the processing circuit may be further configured to include the identifier in the access token request when requesting access to the UDSF data repository service.

[0127] Example 5 may include an apparatus as described in Example 4 and / or some other example herein, wherein the processing circuit may be further configured to authorize the NF service consumer to access the requested domain, storage, and record based on the identifier and NF type.

[0128] Example 6 may include an apparatus as described in Example 5 and / or some other example herein, wherein the processing circuit may be further configured to include the authorized realm, storage, and recording in the access token.

[0129] Example 7 may include an apparatus as described in Example 1 and / or some other example herein, wherein the NF service consumer may include the authorized domain, storage, and record with the access token when requesting the UDSF data repository service.

[0130] Example 8 may include an apparatus as described in Example 7 and / or some other example herein, wherein the processing circuit may be further configured to check whether the requested service operation matches the authorization realm, storage, and record provided with the access token.

[0131] Example 9 may include an apparatus as described in Example 1 and / or some other example herein, wherein upon successful checking, the processing circuit may be further configured to perform the requested service and respond to the NF service consumer.

[0132] Example 10 may include an apparatus as described in Example 1 and / or some other example herein, wherein the processing circuit may be further configured to encode security credentials for data confidentiality within the access token, the credentials being assigned to the NF service consumer when access is authorized.

[0133] Example 11 may include a computer-readable medium storing computer-executable instructions that, when executed by one or more processors, result in the performance of operations, the operations comprising: decoding a request from a network function (NF) service consumer for access to an unstructured data storage function (UDSF) data repository service, the request comprising access parameters; deciphering whether the NF service consumer is authorized to access based on the access parameters; if the NF service consumer is authorized, encoding an access token, the access token comprising an authorized subset of the access parameters; encoding a response to the NF service consumer, the response comprising the encoded access token for subsequent use in a request to the UDSF data repository service.

[0134] Example 12 may include the computer-readable medium of Example 11 and / or some other example herein, wherein the operations further comprise encoding the access token using an OAuth2 protocol.

[0135] Example 13 may include a computer-readable medium as described in Example 11 and / or some other example herein, wherein the operation further includes enforcing logical storage space isolation of NFs of the same type and the same vendor by assigning a dedicated record, storage, or domain identified by the access parameter.

[0136] Example 14 may include the computer-readable medium of Example 11 and / or some other example herein, wherein the operations further include including the identifier in the access token request when requesting access to the UDSF data repository service.

[0137] Example 15 may include a computer-readable medium as described in Example 14 and / or some other example herein, wherein the operation further includes authorizing the NF service consumer to access the requested domain, storage, and records based on the identifier and the NF type.

[0138] Example 16 may include a computer-readable medium as described in Example 15 and / or some other example herein, wherein the operations further include including the authorized realm, storage, and recording in the access token.

[0139] Example 17 may include a computer-readable medium as described in Example 11 and / or some other example herein, wherein the NF service consumer may include the authorized domain, storage, and record with the access token when requesting the UDSF data repository service.

[0140] Example 18 may include a computer-readable medium as described in Example 17 and / or some other example herein, wherein the operation further comprises checking whether the requested service operation matches the authorization realm, storage, and record provided with the access token.

[0141] Example 19 may include a computer-readable medium as described in Example 11 and / or some other example herein, wherein, upon successful checking, the processing circuit may be further configured to perform the requested service and respond to the NF service consumer.

[0142] Example 20 may include a computer-readable medium as described in Example 11 and / or some other example herein, wherein the operation further comprises encoding security credentials for data confidentiality within the access token, the credentials being assigned to the NF service consumer when access is authorized.

[0143] Example 21 may include a method comprising: decoding a request from a network function (NF) service consumer for access to an unstructured data storage function (UDSF) data repository service, the request including access parameters; deciphering whether the NF service consumer is authorized to access based on the access parameters; if the NF service consumer is authorized, encoding an access token, the access token including an authorized subset of the access parameters; encoding a response to the NF service consumer, the response including the encoded access token for subsequent use in a request to the UDSF data repository service.

[0144] Example 22 may include a method as described in Example 21 and / or some other example herein, further comprising encoding the access token using the OAuth2 protocol.

[0145] Example 23 may include a method as described in Example 21 and / or some other example herein, further comprising enforcing logical storage space isolation of NFs of the same type and same vendor by assigning a dedicated record, storage, or domain identified by the access parameter.

[0146] Example 24 may include a method as described in Example 21 and / or some other example herein, further comprising including the identifier in an access token request when requesting access to a UDSF data repository service.

[0147] Example 25 may include a method as described in Example 24 and / or some other example herein, further comprising authorizing the NF service consumer to access the requested domain, storage, and records based on the identifier and the NF type.

[0148] Example 26 may include a method as described in Example 25 and / or some other example herein, further comprising including the authorized realm, storage, and recording in the access token.

[0149] Example 27 may include a method as described in Example 21 and / or some other example herein, wherein the NF service consumer may include the authorized domain, storage, and record with the access token when requesting the UDSF data repository service.

[0150] Example 28 may include a method as described in Example 27 and / or some other example herein, further comprising checking whether the requested service operation matches the authorization realm, storage, and record provided with the access token.

[0151] Example 29 may include a method as described in Example 21 and / or some other example herein, wherein upon successful checking, the processing circuit may be further configured to perform the requested service and respond to the NF service consumer.

[0152] Example 30 may include a method as described in Example 21 and / or some other example herein, further comprising encoding security credentials for data confidentiality within the access token, the credentials being assigned to the NF service consumer when access is authorized.

[0153] Example 31 may include a device comprising a device for performing the following operations: decoding a request from a network function (NF) service consumer for access to an unstructured data storage function (UDSF) data repository service, the request including access parameters; deciphering whether the NF service consumer is authorized to access based on the access parameters; if the NF service consumer is authorized, encoding an access token, the access token including an authorized subset of the access parameters; encoding a response to the NF service consumer, the response including the encoded access token for subsequent use in a request to the UDSF data repository service.

[0154] Example 32 may include an apparatus as described in Example 31 and / or some other example herein, further comprising encoding the access token using the OAuth2 protocol.

[0155] Example 33 may include an apparatus as described in Example 31 and / or some other example herein, further comprising enforcing logical storage space isolation of NFs of the same type and the same vendor by assigning a dedicated record, storage, or domain identified by the access parameter.

[0156] Example 34 may include an apparatus as described in Example 31 and / or some other example herein, further comprising including the identifier in an access token request when requesting access to a UDSF data repository service.

[0157] Example 35 may include an apparatus as described in Example 34 and / or some other example herein, further comprising authorizing the NF service consumer to access the requested domain, storage, and records based on the identifier and the NF type.

[0158] Example 36 may include an apparatus as described in Example 35 and / or some other example herein, further comprising including the authorized realm, storage, and recording in the access token.

[0159] Example 37 may include an apparatus as described in Example 31 and / or some other example herein, wherein the NF service consumer may include the authorized domain, storage, and record with the access token when requesting the UDSF data repository service.

[0160] Example 38 may include an apparatus comprising means for performing any of the methods described in Examples 1-37.

[0161] Example 39 may include a network node comprising a communication interface and a processing circuit connected thereto, the processing circuit being configured to perform the method described in Examples 1-37, wherein the network node may be a base station (e.g., NodeB, eNodeB, gNodeB, or other naming of a base station based on the generation of the cellular network).

[0162] Example 40 may include an apparatus comprising means for performing one or more elements of a method described in or related to any of Examples 1-37, or any other method or process described herein.

[0163] Example 41 may include one or more non-transitory computer-readable media including instructions that, when executed by one or more processors of an electronic device, cause the electronic device to perform one or more elements of a method described in or related to any of Examples 1-37 or any other method or process described herein.

[0164] Example 42 may include an apparatus comprising logic, modules, or circuits for performing one or more elements of a method described in or related to any of Examples 1-37, or any other method or process described herein.

[0165] Example 43 may include methods, techniques, or processes as described in or related to any of Examples 1-37, or portions thereof.

[0166] Example 44 may include a device comprising: one or more processors and one or more computer-readable media comprising instructions, which, when executed by the one or more processors, cause the one or more processors to perform a method, technique, or process, or some portion thereof, as described in or related to any of Examples 1-37.

[0167] Example 45 may include a signal as described in or related to any of Examples 1-37, or some portion thereof.

[0168] Example 46 may include a datagram, packet, frame, fragment, protocol data unit (PDU), or message as described in or related to any of Examples 1-37, or some portion thereof, or a datagram, packet, frame, fragment, protocol data unit (PDU), or message otherwise described in the present disclosure.

[0169] Example 47 may include a signal encoding data as described in or associated with any of Examples 1-37, or portions thereof, or data otherwise described in this disclosure.

[0170] Example 48 may include a signal encoding a datagram, packet, frame, fragment, protocol data unit (PDU), or message as described in or related to any of Examples 1-37, or some portion thereof, or a datagram, packet, frame, fragment, protocol data unit (PDU), or message otherwise described in the present disclosure.

[0171] Example 49 may include an electromagnetic signal carrying computer-readable instructions, wherein execution of the computer-readable instructions by one or more processors causes the one or more processors to perform a method, technique, or process, or portions thereof, as described in or related to any of Examples 1-37.

[0172] Example 50 may include a computer program comprising instructions, wherein execution of the program by a processing element causes the processing element to perform a method, technique, or process, or some portion thereof, as described in or related to any of Examples 1-37.

[0173] Example 51 may include signals in a wireless network as shown and described herein.

[0174] Example 52 may include a method of communicating in a wireless network as shown and described herein.

[0175] Example 53 may include a system for providing wireless communications as shown and described herein.

[0176] Example 54 may include an apparatus for providing wireless communications as shown and described herein.

[0177] One example implementation is an edge computing system, including various edge processing devices and nodes to call or perform the operations of the above examples or other topics described herein. Another example implementation is a client endpoint node, which is operable to call or perform the operations of the above examples or other topics described herein. Another example implementation is an aggregation node, a network hub node, a gateway node, or a core data processing node, which is within the edge computing system or coupled to the edge computing system, and is operable to call or perform the operations of the above examples or other topics described herein. Another example implementation is an access point, a base station, a roadside unit, a street unit, or an in-field unit, which is within the edge computing system or coupled to the edge computing system, and is operable to call or perform the operations of the above examples or other topics described herein. Another example implementation is an edge configuration node, a service orchestration node, an application orchestration node, or a multi-tenant management node, which is within the edge computing system or coupled to the edge computing system, and is operable to call or perform the operations of the above examples or other topics described herein. Another example implementation is an edge node that operates edge provisioning services, application or service orchestration services, virtual machine deployment, container deployment, function deployment, and compute management, within or coupled to an edge computing system, operable to invoke or perform operations of the above examples or other topics described herein. Another example implementation is an edge computing system that is operable as an edge grid, an edge grid with sidecar loading, or with grid-to-grid communications, operable to invoke or perform operations of the above examples or other topics described herein. Another example implementation is an edge computing system that includes aspects of network functions, acceleration functions, acceleration hardware, storage hardware, or computing hardware resources, operable to invoke or perform use cases discussed herein, utilizing the above examples, or other topics described herein. Another example implementation is an edge computing system adapted to support client mobility, vehicle-to-vehicle (V2V), vehicle-to-everything (V2X), or vehicle-to-infrastructure (V2I) scenarios, and optionally operating in accordance with ETSIMEC specifications, operable to invoke or perform the use cases discussed herein, utilizing the above examples, or other subject matter described herein. Another example implementation is an edge computing system adapted for mobile wireless communications, including configuration in accordance with 3GPP 4G / LTE or 5G network capabilities, operable to invoke or perform the use cases discussed herein, utilizing the above examples, or other subject matter described herein.Another example implementation is a computing system adapted for network communications, including configuration according to O-RAN capabilities, operable to invoke or perform the use cases discussed herein, utilizing the above examples, or other subject matter described herein.

[0178] Unless explicitly stated otherwise, any of the above examples may be combined with any other example (or combination of examples). The above description of one or more implementations provides illustrations and descriptions, but is not intended to be exhaustive or to limit the scope of the embodiments to the precise forms disclosed. Modifications and variations are possible in light of the above teachings or may be obtained by implementing the various embodiments.

[0179] the term

[0180] The terms used herein are only for describing specific embodiments and are not intended to be limitations of the present disclosure. When used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It is also to be understood that the term "comprising" when used in this specification specifies the presence of the described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0181] For purposes of this disclosure, the phrase "A and / or B" means (A), (B), or (A and B). For purposes of this disclosure, the phrase "A, B, and / or C" means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B and C). The description may use the phrase "in one embodiment" or "in some embodiments," each of which may refer to one or more of the same or different embodiments. In addition, the terms "including," "comprising," "having," and the like, used with respect to embodiments of the present disclosure, are synonymous.

[0182] The terms "coupled," "communicatively coupled," and their derivatives are used herein. The term "coupled" may mean that two or more elements are in direct physical or electrical contact with each other, may mean that two or more elements are in indirect contact with each other, but still cooperate or interact with each other, and / or may mean that one or more other elements are coupled or connected between the elements allegedly coupled to each other. The term "directly coupled" may mean that two or more elements are in direct contact with each other. The term "communicatively coupled" may mean that two or more elements are in contact with each other by means of communication, including by wires or other interconnections, by wireless communication channels or links, and the like.

[0183] The term "circuit" as used herein refers to a hardware component such as, a part of, or including an electronic circuit, a logic circuit, a processor (shared, dedicated, or grouped) and / or a memory (shared, dedicated, or grouped), an Application Specific Integrated Circuit (ASIC), a field-programmable device (FPD) (e.g., a field-programmable gate array (FPGA), a programmable logic device (PLD), a complex PLD (CPLD), a high-capacity PLD (HCPLD), a structured ASIC, or a programmable SoC), a digital signal processor (DSP), etc. In some embodiments, the circuit may execute one or more software or firmware programs to provide at least some of the functions described. The term "circuit" may also refer to a combination of one or more hardware elements (or circuits used in electrical or electronic systems) and program code to perform the functions of the program code. In these embodiments, the combination of hardware elements and program code may be referred to as a specific type of circuit.

[0184] The term "processor circuit" used herein refers to a circuit that is part of or includes a circuit that can sequentially and automatically perform a sequence of operations or logical operations, or record, store and / or transmit digital data. The processing circuit may include one or more processing cores to execute instructions, and one or more memory structures to store program and data information. The term "processor circuit" may refer to one or more application processors, one or more baseband processors, a physical central processing unit (CPU), a single-core processor, a dual-core processor, a triple-core processor, a quad-core processor, and / or any other device capable of executing or otherwise operating computer executable instructions such as program code, software modules and / or functional processes. The processing circuit may include more hardware accelerators, which may be microprocessors, programmable processing devices, and the like. The one or more hardware accelerators may include, for example, computer vision (CV) and / or deep learning (DL) accelerators. The terms "application circuit" and / or "baseband circuit" may be considered synonymous with "processor circuit" and may be referred to as "processor circuit".

[0185] The terms "memory" and / or "memory circuit" as used herein refer to one or more hardware devices for storing data, including RAM, MRAM, PRAM, DRAM and / or SDRAM, core memory, ROM, magnetic disk storage media, optical storage media, flash memory devices, or other machine-readable media for storing data. The term "computer-readable medium" may include, but is not limited to, memory, portable or fixed storage devices, optical storage devices, and various other media capable of storing, containing, or carrying instructions or data.

[0186] As used herein, the term "interface circuit" refers to, is a part of, or includes a circuit that enables information exchange between two or more components or devices. The term "interface circuit" may refer to one or more hardware interfaces, such as a bus, an I / O interface, a peripheral component interface, a network interface card, and the like.

[0187] The term "user equipment" or "UE" as used herein refers to a device with radio communication capabilities and may describe a remote user of network resources in a communication network. The term "user equipment" or "UE" may be considered synonymous with and may be referred to as the following terms: client, mobile phone, mobile device, mobile terminal, user terminal, mobile unit, mobile station, mobile user, subscriber, user, remote station, access agent, user agent, receiver, radio device, reconfigurable radio device, reconfigurable mobile device, etc. In addition, the term "user equipment" or "UE" may include any type of wireless / wired device or any computing device that includes a wireless communication interface.

[0188] The term "network element" as used herein refers to a physical or virtualized device and / or infrastructure used to provide wired or wireless communication network services. The term "network element" may be considered synonymous with and / or referred to as the following terms: networked computer, networking hardware, network device, network node, router, switch, hub, bridge, radio network controller, RAN equipment, RAN node, gateway, server, virtualized VNF, NFVI, etc.

[0189] As used herein, the term "computer system" refers to any type of interconnected electronic devices, computer devices, or components thereof. Additionally, the terms "computer system" and / or "system" may refer to components of a computer that are communicatively coupled to one another. Additionally, the terms "computer system" and / or "system" may refer to multiple computer devices and / or multiple computing systems that are communicatively coupled to one another and configured to share computing and / or networking resources.

[0190] The terms "appliance", "computer appliance" and the like used herein refer to a computer device or computer system with a program code (e.g., software or firmware) specifically designed to provide specific computing resources. A "virtual appliance" is a virtual machine image to be implemented by a device equipped with a hypervisor that is virtualized or simulated or otherwise dedicated to providing specific computing resources. The term "element" refers to a unit that is indivisible and has well-defined boundaries at a given level of abstraction, wherein an element can be any type of entity, including, for example, one or more devices, systems, controllers, network elements, modules, etc., or a combination of these. The term "device" refers to a physical entity that is embedded in or attached to another physical entity in its vicinity, and has the ability to communicate digital information from or to the physical entity. The term "entity" refers to a unique component of an architecture or device, or information transmitted as a payload. The term "controller" refers to an element or entity that has the ability to affect a physical entity, such as by changing its state or causing the physical entity to move.

[0191] The term "cloud computing" or "cloud" refers to a paradigm for enabling network access to a scalable and elastic pool of shareable computing resources, with on-demand self-service provisioning and management, and without the need for active management by users. Cloud computing provides cloud computing services (or cloud services), which are one or more capabilities provided via cloud computing, which are invoked using defined interfaces (e.g., APIs, etc.). The term "computing resources" or simply "resources" refers to any physical or virtual component with limited availability within a computer system or network, or the use of such a component. Examples of computing resources include the use / access of servers, (one or more) processors, storage devices, memory devices, memory areas, networks, power, input / output (peripheral) devices, mechanical devices, network connections (e.g., channels / links, ports, network sockets, etc.), operating systems, virtual machines (VMs), software / applications, computer files, etc., over a period of time. "Hardware resources" may refer to computing, storage, and / or network resources provided by (one or more) physical hardware elements. "Virtualized resources" may refer to computing, storage and / or network resources provided by a virtualized infrastructure to applications, devices, systems, and the like. The term "network resources" or "communication resources" may refer to resources accessible by a computer device / system via a communication network. The term "system resources" may refer to any kind of shared entity that provides services, and may include computing and / or network resources. System resources may be considered as a collection of coherent functions, network data objects, or services accessible through a server, wherein such system resources reside on a single host or multiple hosts and are clearly identifiable. As used herein, the term "cloud service provider" (or CSP) refers to an organization that operates generally large-scale "cloud" resources, which are composed of centralized, regional, and edge data centers (e.g., used in the context of a public cloud). In other examples, CSPs may also be referred to as cloud service operators (Cloud Service Operators, CSOs). Mentioning "cloud computing" generally refers to computing resources and services provided by a CSP or CSO at a remote location, with at least some increase in latency, distance, or constraints relative to edge computing.

[0192] As used herein, the term "data center" refers to a specially designed structure that is intended to accommodate multiple high-performance computing and data storage nodes, so that a large amount of computing, data storage, and network resources exist in a single location. This often requires specialized rack and enclosure systems, appropriate heating, cooling, ventilation, security, fire extinguishing, and power delivery systems. In some contexts, the term may also refer to computing and data storage nodes. The size of a data center can vary between a centralized or cloud data center (e.g., the largest), a regional data center, and an edge data center (e.g., the smallest).

[0193] As used herein, the term "edge computing" refers to the implementation, coordination and use of computing and resources at a location closer to the "edge" or "edge" collection of the network. Deploying computing resources at the edge of the network can reduce application and network latency, reduce network backhaul traffic and associated energy consumption, improve service capabilities, improve compliance with security or data privacy requirements (especially compared to traditional cloud computing), and improve total cost of ownership. As used herein, the term "edge computing node" refers to a real-world, logical or virtualized implementation of an element with computing capabilities in the form of a device, gateway, bridge, system or subsystem, component, whether it is operated in a server, client, endpoint or peer mode, and whether it is located at the "edge" of the network or at a further connection location within the network. "Nodes" mentioned herein are generally interchangeable with "devices", "components" and "subsystems"; however, "edge computing systems" or "edge computing networks" generally refer to a distributed architecture, organization or collection of multiple nodes and devices, and they are organized to complete or provide some aspects of services or resources in an edge computing environment.

[0194] Additionally or alternatively, the term "edge computing" refers to a concept, as described in [6], that enables operator and third-party services to be hosted close to the UE's attachment access point to achieve efficient service delivery by reducing end-to-end latency and load on the transport network. As used herein, the term "edge computing service provider" refers to a mobile network operator or third-party service provider that provides edge computing services. As used herein, the term "edge data network" refers to a local data network (DN) that supports an architecture for implementing edge applications. As used herein, the term "edge hosting environment" refers to an environment that provides the support required for the execution of an edge application server. As used herein, the term "application server" refers to application software that resides in the cloud and performs server functions.

[0195] The term "Internet of Things" or "IoT" refers to a system of interconnected computing devices, mechanical and digital machines that can transmit data with little or no human interaction, and may involve technologies such as real-time analytics, machine learning and / or AI, embedded systems, wireless sensor networks, control systems, automation (e.g., smart home, smart building, and / or smart city technologies), etc. IoT devices are typically low-power devices without significant computing or storage capabilities. An "edge IoT device" may be any kind of IoT device deployed at the edge of a network.

[0196] As used herein, the term "cluster" refers to a collection or grouping of entities that are part of (one or more) edge computing systems, in the form of physical entities (e.g., different computing systems, networks, or network groups), logical entities (e.g., applications, functions, security constructs, containers), etc. In some places, "clusters" are also referred to as "groups" or "domains." The membership of a cluster can be modified or affected based on conditions or functions, including from dynamic or attribute-based membership, from network or system management scenarios, or from various example techniques discussed below that can add, modify, or remove entities from a cluster. A cluster may also include or be associated with multiple layers, multiple levels, or multiple attributes, including changes in security functions and results based on such layers, levels, or attributes.

[0197] The term "application" may refer to a complete, deployable, packaged environment that implements a certain function in an operating environment. The term "AI / ML application" or similar terms may be an application that contains some AI / ML models and application-level descriptions. The term "machine learning" or "ML" refers to the use of a computer system that implements an algorithm and / or statistical model to perform (one or more) specific tasks without explicit instructions, but relying on patterns and reasoning. The ML algorithm builds or estimates (one or more) mathematical models (called "ML models" and the like) based on sample data (called "training data", "model training information", etc.) to make predictions or decisions without being explicitly programmed to perform such tasks. In general, an ML algorithm is a computer program that learns from experience and a certain performance metric about a certain task, and an ML model may be an object or data structure created after training the ML algorithm with one or more training data sets. After training, the ML model can be used to make predictions on new data sets. Although the term "ML algorithm" refers to a different concept from the term "ML model", these terms as described herein can be used interchangeably for the purposes of this disclosure.

[0198] The terms "machine learning model", "ML model" or similar terms may also refer to the ML methods and concepts used by ML-assisted solutions. "ML-assisted solutions" are solutions that use ML algorithms to solve specific use cases during operation. ML models include supervised learning (e.g., linear regression, k-nearest neighbor (KNN), decision tree algorithm, support machine vector, Bayesian algorithm, lumping algorithm, etc.), unsupervised learning (e.g., K-means clustering, principal component analysis (PCA), etc.), reinforcement learning (e.g., Q-learning, multi-armed bandit learning, deep RL, etc.), neural networks, etc. Depending on the implementation, a specific ML model may have many sub-models as components, and the ML model may train all sub-models together. During inference, separately trained ML models may also be chained together in an ML pipeline. "ML pipeline" is a set of functionalities, functions, or functional entities that depend on an ML-assisted solution; an ML pipeline may include one or several data sources in a data pipeline, a model training pipeline, a model evaluation pipeline, and actors. An "actor" is an entity that uses the output of ML model inference to host an ML-assisted solution. The term "ML training host" refers to an entity, such as a network function, that hosts the training of a model. The term "ML inference host" refers to an entity, such as a network function, that hosts a model during inference mode (this includes both model execution and any online learning if applicable). The ML host informs the actor of the output of the ML algorithm, and the actor makes decisions for actions (an "action" is performed by the actor as a result of the output of the ML-assisted solution). The term "model inference information" refers to information used as input to an ML model to determine (one or more) inferences; the data used to train an ML model and the data used to determine inferences may overlap, however, "training data" and "inference data" refer to different concepts.

[0199] As used herein, the term "instantiation" and the like refer to the creation of an instance. "Instance" also refers to a specific occurrence of an object, which may occur, for example, during the execution of program code. The term "information element" refers to a structural element containing one or more fields. The term "field" refers to the individual content of an information element, or a data element containing content. As used herein, "database object", "data structure" or similar terms may refer to any information representation in the form of an object, attribute-value pair (AVP), key-value pair (KVP), tuple, etc., and may include variables, data structures, functions, methods, classes, database records, database fields, database entities, data and / or associations between database entities (also referred to as "relationships"), blocks in a blockchain implementation and links between blocks, etc.

[0200] As used herein, "information object" refers to a collection of structured data and / or any information representation, and may include, for example, electronic documents (or "documents"), database objects, data structures, files, audio data, video data, raw data, archived files, application packages, and / or any other similar information representations. The term "electronic document" or "document" may refer to a data structure, computer file, or resource for recording data, and includes various file types and / or data formats, such as word processing documents, spreadsheets, slide presentations, multimedia projects, web pages, and / or source code documents, among others. For example, an information object may include markup and / or source code documents, such as HTML, XML, JSON, CSS, JSP, MessagePack TM , Thrift TM 、ASN.1、 Protocol Buffer (protobuf) or some other document / format, such as those discussed in this article. Information objects can have both a logical structure and a physical structure. Physically, an information object consists of one or more units called entities. An entity is a storage unit that contains content and is identified by a name. Entities can refer to other entities so that they are included in the information object. An information object begins with a document entity, which is also called the root element (or "root"). Logically, an information object consists of one or more declarations, elements, comments, character references, and processing instructions, all of which are indicated in the information object (for example, using tags).

[0201] The term "data item" as used herein refers to the atomic state of a particular object having at least one particular attribute at a point in time. Such an object is typically identified by an object name or object identifier, and the attributes of such an object are typically defined as database objects (e.g., fields, records, etc.), object instances, or data elements (e.g., markup language elements / tags, etc.). Additionally or alternatively, the term "data item" as used herein may refer to data elements and / or content items, although these terms may refer to different concepts. The term "data element" or "element" as used herein refers to a unit that is indivisible and has well-defined boundaries at a given level of abstraction. A data element is a logical component of an information object (e.g., an electronic document) that can be identified by a start tag (e.g., " <element> ”) and ends with a matching end tag (e.g., "< / element> ") or just an empty element tag (for example, " <element / > ”). Any characters between the start and end tags (if any) are the content of the element (referred to herein as “content items” or the like).

[0202] The content of an entity may include one or more content items, each of which has an associated data type representation. Content items may include, for example, attribute values, character values, URIs, qualified names (qnames), parameters, and the like. A qname is the fully qualified name of an element, attribute, or identifier in an information object. A qname associates the URI of a namespace with the local name of an element, attribute, or identifier in that namespace. To establish this association, a qname assigns a prefix to the local name that corresponds to its namespace. A qname includes the URI, prefix, and local name of a namespace. Namespaces are used to provide uniquely named elements and attributes in information objects. Content items may include text content (for example, " <element> content item< / element> ”), attributes (e.g., “<element attribute="attributeValue"> ”) and other elements called “child elements” (e.g., “ <element1> <element2> content item< / element2> < / element1> ”). An “attribute” may refer to a markup structure consisting of a name-value pair present within a start tag or an empty element tag. An attribute contains data associated with its element and / or controls the behavior of that element.

[0203] The term "channel" as used herein refers to any transmission medium, whether tangible or intangible, for conveying data or data streams. The term "channel" may be synonymous with "communication channel", "data communication channel", "transmission channel", "data transmission channel", "access channel", "data access channel", "link", "data link", "carrier", "radio frequency carrier" and / or any other similar term representing a channel or medium through which data is conveyed and / or equivalent to such terms. In addition, the term "link" as used herein refers to a connection between two devices through a RAT in order to send and receive information. As used herein, the term "radio technology" refers to a technology for wireless transmission and / or reception of electromagnetic radiation for information transmission. The term "radio access technology" or "RAT" refers to a technology for underlying physical connection with a radio-based communication network. As used herein, the term "communication protocol" (wired or wireless) refers to a set of standardized rules or instructions implemented by a communication device and / or system for communicating with other devices and / or systems, including instructions for packetizing / unpacking data, modulating / demodulating signals, implementing protocol stacks, and the like.

[0204] As used herein, the term "radio technology" refers to the technology for wireless transmission and / or reception of electromagnetic radiation for information transfer. The term "radio access technology" or "RAT" refers to the technology used to make an underlying physical connection to a radio-based communication network. As used herein, the term "communication protocol" (wired or wireless) refers to a set of standardized rules or instructions implemented by a communication device and / or system for communicating with other devices and / or systems, including instructions for packetizing / unpacking data, modulating / demodulating signals, implementing a protocol stack, and the like. Examples of wireless communication protocols that may be used in various embodiments include Global System for Mobile Communications (GSM) radio communication technology, General Packet Radio Service (GPRS) radio communication technology, Enhanced Data Rates for GSM Evolution (EDGE) radio communication technology, and / or Third Generation Partnership Project (3GPP) radio communication technology, including, for example, 3GPP Fifth Generation (5G) or New Radio (NR), Universal Mobile Telecommunications System (UMTS), Freedom of Multimedia Access (FOMA), Long Term Evolution (LTE), LTE Advanced, LTE Extra, LTE-A Pro, cdmaOne (2G), Code Division Multiple Access 2000 (CDMA2000), Cellular Digital Packet Data (CDMA2000), and LTE-A Pro. Data, CDPD), Mobitex, Circuit Switched Data (CSD), High-Speed ​​CSD (HSCSD), Universal Mobile Telecommunications System (UMTS), Wideband Code Division Multiple Access (W-CDM),High Speed ​​Packet Access (HSPA), HSPA+, Time Division-Code Division Multiple Access (TD-CDMA), Time Division-Synchronous Code Division Multiple Access (TD-SCDMA), LTE LAA, MuLTEfire, UMTS Terrestrial Radio Access (UTRA), Evolved UTRA (E-UTRA), Evolution-Data Optimized or Evolution-Data Only (EV-DO), Advanced Mobile Phone System (AMPS), Digital AMPS (D-AMPS), Total Access Communication System / Extended Total Access Communication System (TACS / ETACS), Push-to-talk (PTT), Mobile Telephone System (UMTS Terrestrial Radio Access, UTRA), Evolved UTRA (E-UTRA), Evolution-Data Optimized or Evolution-Data Only (EV-DO), Advanced Mobile Phone System (AMPS), Digital AMPS (D-AMPS), Total Access Communication System / Extended Total Access Communication System (TACS / ETACS), Push-to-talk (PTT), Mobile Telephone System (UMTS System, MTS), Improved Mobile Telephone System (IMTS), Advanced Mobile Telephone System (AMTS), Cellular Digital Packet Data (CDPD), DataTAC, Integrated Digital Enhanced Network (iDEN), Personal Digital Cellular (PDC), Personal Handy-phone System (PHS), Wideband Integrated Digital Enhanced Network (WiDEN), iBurst, Unlicensed Mobile Access (UMA) (also known as 3GPP Universal Access Network, or Standard GAN), Bluetooth Low Energy (BLE), IEEE 802.15.4-based protocols (e.g., IPv6 over Low power Wireless Personal Area Networks (6LoWPAN), WirelessHART, MiWi, Thread, 802.11a, etc.), WiFi Direct, ANT / ANT+, ZigBee, Z-Wave, 3GPP device-to-device (D2D) or Proximity Service (ProSe), Universal Plug and Play (UPnP), Low-Power Wide-Area-Network (LPWAN), Long Range Wide Area Network (LoRA) or LoRaWAN developed by Semtech and the LoRa Alliance TM , Sigfox, Wireless Gigabit Alliance (WiGig) standards, Worldwide Interoperability for Microwave Access (WiMAX), general mmWave standards (e.g., wireless systems operating at 10-300 GHz and above, such as WiGig, IEEE 802.11ad, IEEE 802.11ay, etc.), V2X communication technologies (including 3GPP C-V2X), Dedicated Short Range Communications (DSRC) communication systems, such as Intelligent-Transport-Systems (ITS), including European ITS-G5, ITS-G5B, ITS-G5C, etc. In addition to the standards listed above, any number of satellite uplink technologies may be used for the purposes of the present disclosure, including, for example, radios that comply with standards published by the International Telecommunication Union (ITU) or the European Telecommunications Standards Institute (ETSI), etc. The examples provided herein are thus understood to be applicable to a variety of other communication technologies, both existing and yet to be developed.

[0205] The term "access network" refers to any network used to connect user devices and service providers using any combination of radio technologies, RATs and / or communication protocols. In the context of WLAN, "access network" refers to the IEEE 802 local area network (LAN) or metropolitan area network (MAN) between the terminal and the access router connected to the provider's services. The term "access router" refers to a router that terminates the medium access control (MAC) service from the terminal and forwards user traffic to the information server based on the Internet Protocol (IP) address.

[0206] The term "SMTC" refers to the SSB-based measurement timing configuration configured by SSB-MeasurementTimingConfiguration. The term "SSB" refers to the synchronization signal / Physical Broadcast Channel (SS / PBCH) block, which includes the primary synchronization signal (PSS), the secondary synchronization signal (SSS), and the PBCH. The term "primary cell" refers to an MCG cell operating on the primary frequency, where the UE either performs an initial connection establishment process or initiates a connection re-establishment process. The term "primary SCG cell" refers to an SCG cell, where the UE performs random access when performing a reconfiguration process with synchronization for DC operation. The term "secondary cell" refers to a cell that provides additional radio resources for UEs configured with CA on top of a special cell. The term "secondary cell group" refers to a subset of service cells for UEs configured with DC, including a PSCell and zero or more secondary cells. The term "serving cell" refers to the primary cell for UEs in RRC_CONNECTED that are not configured with CA / DC, with only one serving cell consisting of the primary cell. The term "serving cell" refers to the set of cells including (one or more) special cells and all secondary cells for UEs in RRC_CONNECTED that are configured with CA. The term "special cell" refers to the PCell of an MCG or the PSCell of an SCG for DC operation; otherwise, the term "special cell" refers to the Pcell.

[0207] The term "A1 policy" refers to a declarative policy expressed using formal statements that enables non-RTRIC functions in the SMO to guide near-RT RIC functions and thus guide the RAN to better achieve the RAN intent.

[0208] The term "A1 enriched information" refers to information utilized by the near-RT RIC that is collected or derived at the SMO / non-RT RIC from non-network data sources or from the network functions themselves.

[0209] The term "A1 policy-based traffic steering processing mode" refers to a mode of operation in which the near-RT RIC is configured via the A1 policy to use traffic steering actions to ensure a more specific notion of network performance (e.g., applicable to smaller groups of E2 nodes and UEs in the RAN) than it ensures in background traffic steering.

[0210] The term "background traffic steering processing mode" refers to an operating mode in which the near-RT RIC is configured through O1 to use traffic steering actions to ensure general background network performance, which is widely applicable to E2 nodes and UEs in the RAN.

[0211] The term "baseline RAN behavior" refers to the default RAN behavior configured by the SMO at the E2 node.

[0212] The term "E2" refers to an interface connecting the near-RT RIC and one or more O-CU-CPs, one or more O-CU-UPs, one or more O-DUs, and one or more O-eNBs.

[0213] The term "E2 node" refers to the logical node that terminates the E2 interface. In this version of the specification, the ORAN node that terminates the E2 interface is: for NR access: O-CU-CP, O-CU-UP, O-DU or any combination; and for E-UTRA access: O-eNB.

[0214] In the context of O-RAN systems / implementations, the term "intent" refers to declarative policies used to control or guide the behavior of RAN functions, allowing the RAN functions to calculate the optimal results to achieve the stated goals.

[0215] The term “O-RAN Non-Real-Time RAN Intelligent Controller” or “Non-RT RIC” refers to a logical function that enables non-real-time control and optimization of RAN elements and resources, AI / ML workflows including model training and updates, and policy-based steering of applications / features in the Near-RT RIC.

[0216] The term “Near RT RIC” or “O-RAN Near Real-Time RAN Intelligent Controller” refers to a logical function that enables near real-time control and optimization of RAN elements and resources via fine-grained (e.g., UE-based, cell-based) data collection and actions over the E2 interface.

[0217] The term “O-RAN Central Unit” or “O-CU” refers to the logical node that hosts the RRC, SDAP and PDCP protocols.

[0218] The term “O-RAN Central Unit - Control Plane” or “O-CU-CP” refers to the logical node that hosts the control plane part of the RRC and PDCP protocols.

[0219] The term “O-RAN Central Unit - User Plane” or “O-CU-UP” refers to the logical node that hosts the user plane part of the PDCP protocol and the SDAP protocol.

[0220] The term “O-RAN Distributed Unit” or “O-DU” refers to a logical node that hosts the RLC / MAC / high PHY layers based on the lower layer functional split.

[0221] The term “O-RAN eNB” or “O-eNB” refers to an eNB or ng-eNB that supports the E2 interface.

[0222] The term "O-RAN Radio Unit" or "O-RU" refers to a logical node that hosts the lower PHY layers and RF processing based on the underlying functional split. This is similar to 3GPP's "TRP" or "RRH", but is more specific in including the lower PHY layers (FFT / iFFT, PRACH extraction).

[0223] The term “O1” refers to the interface between the orchestration and management entity (orchestration / NMS) and the O-RAN managed elements for operations and management, through which FCAPS management, software management, file management and other similar functions should be implemented.

[0224] The term "RAN UE Group" refers to an aggregation of UEs, the grouping of which is also set up in the E2 node through E2 procedures based on the scope of the A1 policy. These groups can then be the target of E2 CONTROL or POLICY messages.

[0225] The term "traffic manipulation action" refers to the use of a mechanism to change RAN behavior. Such actions include E2 procedures such as CONTROL and POLICY.

[0226] The term "traffic steering inner loop" refers to the part of the traffic steering processing that is triggered by the arrival of periodic TS-related KPMs (Key Performance Measurements) from the E2 node, which includes UE grouping, setting up additional data collection from the RAN, and selecting and executing one or more optimization actions to implement the traffic steering policy.

[0227] The term "traffic steering outer loop" refers to the part of the traffic steering processing that is triggered by the near-RT RIC setting or updating the traffic steering aware resource optimization process based on information from A1 policy settings or updates, A1 enrichment information (EI) and / or the results of near-RT RIC evaluation, including the initial configuration (preconditions) and the injection of relevant A1 policies, and the triggering conditions for TS changes.

[0228] The term "traffic steering processing mode" refers to an operating mode in which the RAN or near RTRIC is configured to ensure specific network performance. This performance includes aspects such as cell load and throughput, and may be applied differently to different E2 nodes and UEs. Throughout this process, "traffic steering actions" are used to meet the requirements of this configuration.

[0229] The term "traffic steering target" refers to the expected performance results desired from the network, which are configured to the near-RT RIC via O1.

[0230] In addition, any of the disclosed embodiments and example implementations may be embodied in the form of various types of hardware, software, firmware, middleware, or a combination thereof, including in the form of control logic, and using such hardware or software in a modular or integrated manner. In addition, any software components or functions described herein may be implemented as software, program code, scripts, instructions, etc. operable to be executed by a processor circuit. These components, functions, programs, etc. may be developed using any appropriate computer language, such as Python, PyTorch, NumPy, Ruby, Ruby on Rails, Scala, Smalltalk, Java, or the like. TM, C++, C#, "C", Kotlin, Swift, Rust, Go (or "Golang"), EMCAScript, JavaScript, TypeScript, Jscript, ActionScript, Server-Side JavaScript (SSJS), PHP, Pearl, Lua, Torch / Lua with Just-In Time compiler (LuaJIT), Accelerated Mobile Pages Script (AMPscript), VBScript, JavaServer Pages (JSP), Active Server Pages (ASP), Node.js, ASP.NET, JAMscript, Hypertext Markup Language (HTML), extensible HTML (XHTML), Extensible Markup Language (XML), XML User Interface Language (XUL), Scalable Vector Graphics (SVG), RESTful API Modeling Language (RAML), Wikimarkup or Wikitext, Wireless Markup Language (Wireless Markup Language) Language, WML), JavaScript Object Notion (JSON), MessagePack TM , Cascading Stylesheet (CSS), extensible stylesheet language (XSL), Mustache template language, Handlebars template language, Guide Template Language (GTL), Thrift, Abstract Syntax Notation One (ASN.1), Protocol Buffer (protobuf), Bytecode, Solidity TM , Vyper (Python derivative), Bamboo, Lisp Like Language (LLL), Blockstream TM Provided Simplicity, Rholang, Michelson, Counterfactual, Plasma, Plutus, Sophia, and / or any other programming language or development tool, including proprietary programming languages ​​and / or development tools. The software code may be stored as computer or processor executable instructions or commands on a physical non-transitory computer readable medium. Examples of suitable media include RAM, ROM, magnetic media (such as hard disk or floppy disk) or optical media (such as compact disk (CD) or DVD (digital versatile disk), flash memory, etc., or any combination of such storage or transmission devices.

[0231] abbreviation

[0232] Unless used differently herein, the terms, definitions and abbreviations may be consistent with those defined in 3GPP TR21.905v16.0.0 (2019-06). For the purposes of this document, the following abbreviations may apply to the examples and embodiments discussed herein.

[0233] Table 1 Abbreviations:

[0234]

[0235]

[0236]

[0237]

[0238]

[0239]

[0240]

[0241]

[0242]

[0243]

[0244]

[0245]

[0246]

[0247]

[0248]

[0249] The above description provides illustrations and descriptions of various example embodiments, but is not intended to be exhaustive or to limit the scope of the embodiments to the precise forms disclosed. Modifications and variations are possible in accordance with the above teachings, or may be obtained by implementing various embodiments. Where specific details are set forth to describe example embodiments of the present disclosure, it should be clear to those skilled in the art that the present disclosure may be implemented without these specific details, or with variations of these specific details. However, it should be understood that the concept of the present disclosure is not intended to be limited to the specific forms disclosed, but rather, it is intended to cover all modifications, equivalents and substitutions consistent with the present disclosure and the appended claims.

Claims

1. A device for a network node, comprising: The processor is configured as: decoding a request from a network function (NF) service consumer to access an unstructured data storage function (UDSF) data repository service, the request including access parameters; deciphering whether the NF service consumer is authorized to access based on the access parameter; If the NF service consumer is authorized, encoding an access token, the access token including an authorized subset of the access parameters; and encoding a response to the NF service consumer, the response including an encoded access token for subsequent use in a request to the UDSF data repository service; as well as A memory is used to store the access token.

2. The device according to claim 1, wherein: The processing circuit is further configured to encode the access token using the OAuth2 protocol.

3. The device according to claim 1, wherein: The processing circuit is further configured to enforce logical storage space isolation of NFs of the same type and same vendor by assigning dedicated records, storages, or areas identified by the access parameters.

4. The device according to claim 1, wherein: The processing circuit is further configured to include the identifier in an access token request when requesting access to the UDSF data repository service.

5. The device according to claim 4, wherein: The processing circuit is further configured to authorize the NF service consumer to access the requested domain, storage, and record based on the identifier and the NF type.

6. The device according to claim 5, wherein: The processing circuit is further configured to include the authorized realm, storage, and recording in the access token.

7. The device of claim 1, wherein: The NF service consumer includes the authorized realm, storage, and record with the access token when requesting the UDSF data repository service.

8. The device according to claim 7, wherein: The processing circuit is further configured to check whether the requested service operation matches an authorized realm, storage, and record provided with the access token.

9. The device of claim 1, wherein: The processing circuit is further configured to: upon successful checking, perform the requested service and respond to the NF service consumer.

10. The device of claim 1, wherein: The processing circuit is further configured to encode security credentials for data confidentiality within the access token, the credentials being assigned to the NF service consumer upon access authorization.

11. A computer readable medium storing computer executable instructions which, when executed by one or more processors, cause operations to be performed, the operations comprising: decoding a request from a network function (NF) service consumer to access an unstructured data storage function (UDSF) data repository service, the request including access parameters; deciphering whether the NF service consumer is authorized to access based on the access parameter; If the NF service consumer is authorized, encoding an access token, the access token including an authorized subset of the access parameters; Encode a response to the NF service consumer, the response including an encoded access token for subsequent use in a request to the UDSF data repository service.

12. The computer-readable medium of claim 11, wherein: The operations also include encoding the access token using the OAuth2 protocol.

13. The computer-readable medium of claim 11, wherein: The operations also include enforcing logical storage space isolation for NFs of the same type and same vendor by assigning dedicated records, storage, or domains identified by the access parameters.

14. The computer-readable medium of claim 11, wherein: The operations further include including the identifier in an access token request when requesting access to the UDSF data repository service.

15. The computer-readable medium of claim 14, wherein: The operations further include authorizing the NF service consumer to access the requested domain, storage, and records based on the identifier and the NF type.

16. The computer-readable medium of claim 15, wherein: The operations further include including an authorized realm, storage, and recording in the access token.

17. The computer-readable medium of claim 11, wherein: The NF service consumer includes the authorized realm, storage, and record with the access token when requesting the UDSF data repository service.

18. The computer readable medium of claim 17, wherein: The operations also include checking whether the requested service operation matches the authorized realm, storage, and record provided with the access token.

19. The computer-readable medium of claim 11, wherein: Upon successful check, the processing circuit is further configured to: perform the requested service and respond to the NF service consumer.

20. The computer readable medium of claim 11, wherein: The operations also include encoding security credentials for data confidentiality within the access token, the credentials being assigned to the NF service consumer upon access authorization.

21. A method comprising: decoding a request from a network function (NF) service consumer to access an unstructured data storage function (UDSF) data repository service, the request including access parameters; deciphering whether the NF service consumer is authorized to access based on the access parameter; If the NF service consumer is authorized, encoding an access token, the access token including an authorized subset of the access parameters; Encode a response to the NF service consumer, the response including an encoded access token for subsequent use in a request to the UDSF data repository service.

22. The method of claim 21, further comprising: The access token is encoded using the OAuth2 protocol.

23. The method of claim 21, further comprising: Logical storage space isolation of NFs of the same type and same vendor is enforced by assigning dedicated records, storage, or fields identified by the access parameters.

24. The method of claim 21, further comprising: When requesting access to the UDSF data repository service, the identifier is included in the access token request.

25. The method of claim 24, further comprising: Based on the identifier and NF type, the NF service consumer is authorized to access the requested domains, storage, and records.

Images